NemoClaw v0.0.65 is out!

[cv]

NemoClaw v0.0.65 is a reliability-focused release for the places where always-on agents meet real machines: gateway recovery, sandbox state, local inference, and messaging activation. The release tightens recovery checks, preserves more runtime state across rebuilds, and makes onboarding failures easier to understand before they turn into confusing agent behavior.

This release also continues the migration of long-running end-to-end coverage into Vitest-backed scenarios. That gives maintainers faster, more targeted signal for OpenClaw, Hermes, messaging, inference, recovery, rebuild, and hosted-nightly paths while keeping the release train easier to operate.

The practical result is a steadier NemoClaw: fewer first-run surprises, clearer inference diagnostics, safer messaging state, and a broader automated safety net around the workflows users rely on when running agents inside OpenShell sandboxes.

OpenClaw, Sandbox, and Recovery

• What changed: gateway waits and recovery now use deadline-based waits, sustained serving checks, restored guard chains, hardened proxy environment sourcing, and recovery for sandboxes whose active gateway no longer has a spec (#2492, #5182, #5321, #5342, #5382). Why it matters: recovery decisions are less likely to mistake a briefly reachable gateway for a healthy one, and failed gateway state is easier to repair.
• What changed: sandbox gateway addressing now handles re-execed OpenClaw health checks, persisted sandbox gateway lookup, sub-agent dial-back through the sandbox interface, multi-gateway dashboard port allocation, and declared agent forward_ports recovery (#4958, #5225, #5238, #5379, #5389). Why it matters: OpenClaw and sub-agent connectivity should survive more rebuild, restart, and multi-sandbox layouts.
• What changed: config restore and registry recovery now fail closed on merge errors, preserve reporter-owned model metadata, re-confirm auto-restore locks after settle, and preserve persisted agents through registry recovery (#5178, #5195, #5205, #5352). Why it matters: rebuild and restore flows keep more user intent intact while avoiding silent partial state merges.
• What changed: onboarding now handles Docker Desktop WSL CDI injection failures, surfaces OpenClaw runtime fallback, writes the current web-search schema, warms up scope upgrades, reserves Hermes port 8642 for all agents, bounds compatible endpoint probes, and summarizes inference validation failures (#5198, #5216, #5264, #5318, #5323, #5400, #5418). Why it matters: first-run and resume paths fail earlier, explain themselves better, and avoid avoidable fallback behavior.
• What changed: the CLI gained sandbox download/upload wrappers and sessions export, while uninstall and shell execution paths now handle TTY confirmation, model-router teardown, and shared shell quoting more reliably (#5201, #5163, #5194, #5344). Why it matters: operators get safer lifecycle commands and more predictable cleanup behavior.

Inference, Hermes, and Runtime Compatibility

• What changed: vLLM and compatible inference setup now preflights NEMOCLAW_VLLM_MODEL before side effects, accepts managed vLLM extra serve args, uses the NVIDIA inference credential environment, recomputes context windows after model switches, and declares Kimi store compatibility (#5214, #5215, #5366, #5404, #5457). Why it matters: local and hosted inference transitions are less brittle, especially when changing models or provider shape.
• What changed: the Hermes baseline policy no longer carries GitHub by default, and E2E coverage now exercises Bedrock Runtime compatible Anthropic and multiturn Kimi tool-call behavior (#5267, #5356, #5413). Why it matters: Hermes defaults stay narrower while compatibility coverage keeps expanding around real provider behaviors.

Messaging, Channels, and Credentials

• What changed: messaging avoids logging WeChat QR poll tokens, resolves the Discord per-account proxy for gateway WebSocket connections, compacts persisted messaging plans, finishes manifest channel migration, removes provider credential hashes from SandboxEntry, and clears remaining hard-coded channel stragglers (#5179, #5248, #5328, #5338, #5410, #5463). Why it matters: channel state is cleaner, Discord activation is more reliable, and credential-adjacent data is handled with less exposure.
• What changed: provider coverage now includes messaging-provider Vitest checks and updated Discord proxy expectations (#5364, #5391). Why it matters: channel regressions should be caught closer to the code that owns the behavior.

Docs, Policy, and Contributor Surface

• What changed: docs and policy guidance now cover Jira curl validation, the v0.0.64 release refresh, scoped AGENTS.md guidance, reserved PRR label taxonomy, custom build cache ordering, and contributor PR verification (#5172, #5358, #5368, #5369, #5371, #5396). Why it matters: maintainers and contributors have clearer local instructions for release work, project labels, custom builds, and PR submission.

CI and Release Confidence

• What changed: the E2E suite migrated a broad set of shell scenarios into Vitest, including Hermes root entrypoint, model-router routed inference, skill-agent runs, sandbox survival, sandbox rebuild, credential sanitization, shields config, crash-loop recovery, gateway drift, gateway health, state backup restore, OpenClaw skill CLI, OpenClaw inference switch, common egress, cloud inference, sessions agents CLI, channels add/remove, and messaging compatible endpoint coverage (#5220, #5221, #5222, #5332, #5333, #5336, #5337, #5348, #5350, #5351, #5353, #5354, #5355, #5357, #5360, #5361, #5362, #5363). Why it matters: high-risk workflows now have more maintainable automated coverage.
• What changed: E2E selectors and workflows were simplified, dispatch parsing was fixed, rebuild helpers tightened, free-standing selectors derived from workflows, token rotation routed through compatible endpoints, compatible credential migration supported, workflow display names normalized, hosted nightly inference stabilized, hosted inference defaults aligned, preapproved scope upgrades tolerated, hosted reachability probes made side-effect-free, and a satisfied legacy repro handled explicitly (#5329, #5330, #5335, #5339, #5370, #5374, #5380, #5381, #5385, #5395, #5399, #5401, #5406, #5411, #5412). Why it matters: nightly and branch-validation signal should be quieter, clearer, and less dependent on incidental provider behavior.
• What changed: nightly onboard trace timing summaries, a centralized fake OpenAI-compatible server, GitHub Code Quality coverage upload, advisor inference routing, deterministic advisor context preloading, cognitive-complexity ratchets, and rebuild outcome coverage all landed in this release (#5245, #5373, #5383, #5384, #5386, #5419, #5420, #5421, #5422, #5471). Why it matters: maintainers get better timing, coverage, and complexity signals while continuing to shrink risky code paths.

Thank You

Thank you to external contributors @HOYALIM, @fallintoplace, @HwangJohn, @johnellison, @Thabhelo, and @zhiyanliu for contributions included in this release (#2492, #5179, #5215, #5238, #5194, #5318).